Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small China retirement-age calculator with no evidence of hidden access, persistence, data collection, or unsafe execution.
Before installing, users should understand this is a China-specific retirement-policy calculator with Chinese-only inputs and output. It requires uv and may prompt to install uv via Homebrew, but the reviewed script only performs local calculations from the values the user provides.
The natural-language description, parameter values, and policy text are all specified only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-language use. The policy allows locale constraints when clearly documented and justified, but this file does not explicitly state such a constraint or provide opt-in.
This code restricts accepted role inputs to Chinese literals only, and the command-line interface text is also Chinese-only. That creates a locale-specific constraint without user opt-in or a documented justification, which matches the language/locale policy violation criteria.
The parser description, help text, and choice labels are presented only in Chinese, which effectively forces a specific language experience. Because the file does not document that the skill is region-specific or provide a language choice, this is a natural-language policy concern.
The manifest says the skill computes retirement time from a user's position information, gender, and birth date. However, the inline CLI help labels --role as 职位类型 while the accepted values are 男性, 女职工, and 女干部, which are gender/employment-category classes rather than general job positions. This is a documentation-level contradiction about what input the code expects.
No suspicious patterns detected.
